Privacy policy
Last updated: 8 October 2026
1. Controller
The controller for the processing of personal data on this website is:
Vesca Systems GmbH
c/o Eric Rosenkranz
Am Carlsgarten 12
10318 Berlin, Germany
Managing director: Eric Alexander Rosenkranz
Commercial register: Amtsgericht Charlottenburg, HRB 292072 B
Email: info@vesca.io
Phone: +49 30 75437688
We have not appointed a data protection officer because there is no legal obligation to do so (§ 38 BDSG). For privacy questions, contact us at info@vesca.io.
2. In short
This website sets no advertising or tracking cookies. Only technically necessary cookies and storage entries of the consent banner are set (see section 5).
We store your choice about cookies and similar technologies in a cookie and in your browser’s local storage (see section 5).
The website is hosted by Framer. We serve fonts from our own hosting; there is no connection to Google Fonts.
If you contact us by email or through the form, we process your details to answer your request.
We make no automated decisions and do no profiling.
3. Hosting and server log files (Framer)
This website is operated and delivered by Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, Netherlands. When you visit the website, the server processes technically necessary data:
IP address
date and time of access
page requested (URL) and referrer URL
browser type, operating system and language (user agent)
Purpose: delivering the website, security and error analysis.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning website).
Retention: log files are kept only as long as needed to operate and secure the website.
Recipient: Framer B.V. as processor (Art. 28 GDPR). According to Framer, it uses Amazon Web Services as a sub-processor, among others.
The connection to this website is encrypted with HTTPS.
4. Audience measurement (Framer Analytics)
We use Framer’s built-in visitor statistics. They work without cookies, without persistent identifiers and without storing information on your device. According to Framer, your IP address and user agent are hashed with a daily rotating secret key that is deleted every day; this is how visitors are counted within a single day. The statistics record page views, session duration, device type, browser, operating system, the approximate country of origin, traffic sources (referrer, UTM parameters), entry and exit pages and error pages (404). There is no cross-site tracking and no profiling.
Purpose: understanding how the website is used so we can improve it.
Legal basis: Art. 6(1)(f) GDPR. You can object at any time (see section 12).
Retention: according to Framer, the daily identifier (hash) is discarded every day. We keep aggregated statistics only as long as needed to evaluate the website.
5. Consent management (consentmanager)
We use the consent manager of consentmanager AB, Haltegelvägen 1b, 72348 Västerås, Sweden, to ask for and document your choices about cookies and similar technologies.
This processes your choice, the time, the version of the settings and technical device information. So that the banner works and your choice is not requested again on every visit, the service sets technically necessary cookies (__cmpconsent110036 for your choice, up to 90 days; __cmpcccu110036, up to 365 days; __cmpccc…, for the session) and entries in your browser’s local storage (cmp_gpcConsentModeEligible…, __cmpcccu110036_…). Because your choice applies to all websites under our consentmanager account, the same cookies are also stored in consentmanager’s own domain (consentmanager.net) through an embedded element, so your browser also connects to consentmanager’s servers. The IP address stored in the consent log is shortened (only part of the address is kept). Some of the cookies are set as soon as you open the page; the cookie __cmpconsent110036, which holds your choice, is created only once you make a selection.
Purpose: obtaining and proving your consent or refusal (Art. 7(1) GDPR).
Legal basis: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR; for storage on your device, § 25(2) no. 2 TDDDG.
Retention: the consent log is deleted after 13 months. The cookies and entries in your browser remain until they expire or you delete them; you can remove them in your browser at any time.
Recipient: consentmanager AB (Sweden) as processor. According to its data processing agreement, it processes the data only in the EU, in data centres of Plusserver GmbH (Cologne, Germany) and UpCloud Oy (Helsinki, Finland). The banner files are delivered through a content delivery network of DataCamp Ltd (London, United Kingdom).
You can change or withdraw your choice at any time using the “Privacy settings” link in the footer.
6. Contact by email
When you write to info@vesca.io, we process your email address, your name (if given) and the content of your message to answer your request.
Legal basis: Art. 6(1)(b) GDPR if your request relates to a contract or pre-contractual steps, otherwise Art. 6(1)(f) GDPR (interest in answering enquiries).
Retention: we delete correspondence 12 months after the last contact, unless it forms part of a business relationship subject to statutory retention periods (see section 11).
Recipient: our email system is operated by Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). For the US transfer, see section 10.
7. Interest form
On our home page you can register your interest in working with us through a form. The form is part of this website and is processed by Framer B.V. (see section 3); no separate form provider is involved. When you submit it, your browser sends the details you entered to Framer’s servers. Framer forwards them as an email notification to our mailbox and writes them into a Google Sheet in our Google Workspace account, which we use to track and follow up enquiries. The submission also remains in the Framer project. We delete it from all these places ourselves, 12 months after the last contact at the latest. The form sets no cookies and stores nothing on your device. Framer checks submissions automatically for spam; for this it evaluates technical signals such as device and browser characteristics, interaction patterns and network signals.
Data collected: name, hotel name, work email address and role.
Purpose: we use your details to contact you about your hotel’s interest and to prepare possible conversations about a pilot phase. We answer your enquiry personally by email; there is no automated onward processing and no marketing email.
Legal basis: Art. 6(1)(b) GDPR (steps at your request prior to entering into a contract) or Art. 6(1)(f) GDPR.
Retention: 12 months after the last contact, longer if a contract is concluded (section 11).
Recipient: Framer B.V. as processor (see section 3); Google Ireland Limited (Google Workspace) as processor for the mailbox and the spreadsheet (see sections 6 and 10).
Obligation to provide data: name, hotel name and email address are required so that we can reply. Providing your role is optional.
8. External links
Our website links to our LinkedIn profile. No LinkedIn plugins are embedded. Only when you click the link does LinkedIn process your data under its own privacy policy (LinkedIn Ireland Unlimited Company).
9. Recipients and processors
Framer B.V.: Hosting, visitor statistics, form – Netherlands
consentmanager AB: Consent management – Sweden (hosting in Germany and Finland)
Google Ireland Limited (Google Workspace): Email system, spreadsheet – Ireland
Internally, only the management and persons authorised by it have access to the data. We disclose data beyond this only where legally required.
10. Transfers to third countries
We choose service providers based and hosted in the EU. A transfer to the USA cannot be ruled out for the following services:
Google Workspace: Google LLC is certified under the EU-US Data Privacy Framework, so the EU Commission’s adequacy decision applies (Art. 45 GDPR). Standard contractual clauses also apply (Art. 46 GDPR).
Framer: Framer B.V. uses Amazon Web Services as a sub-processor. According to Framer, it bases transfers to third countries such as the USA on the EU-US Data Privacy Framework or standard contractual clauses.
The banner files of our consent management tool are delivered through a content delivery network in the United Kingdom; for the UK there is an adequacy decision of the EU Commission (Art. 45 GDPR). You can request a copy of the safeguards at info@vesca.io.
11. Retention periods
Server log files: as long as needed for operation and security
Statistics data: as long as needed for evaluation; daily identifier discarded daily
Consent record (consentmanager): 13 months
Email and form enquiries: 12 months after the last contact
Business letters and contract documents: 6 years (§ 257 HGB, § 147 AO), accounting records 8 to 10 years
Statutory retention obligations remain unaffected.
12. Your rights
Under the GDPR you have the right to:
access your stored data (Art. 15 GDPR)
rectification of inaccurate data (Art. 16 GDPR)
erasure (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)
withdraw consent with effect for the future (Art. 7(3) GDPR)
Right to object (Art. 21 GDPR): where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons.
To exercise your rights, write to info@vesca.io. To protect your data, we may need to verify your identity.
13. Obligation to provide data
You can visit the website without providing personal data. If you contact us by email, we need your email address to be able to reply. For the interest form, name, hotel name and email address are required (see section 7).
14. Automated decisions and profiling
There is no automated decision-making, including profiling, under Art. 22 GDPR.
15. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin, Germany
16. Changes to this policy
We update this policy when our processing or the law changes. The date of the current version is at the top. If a change requires new consent, we will ask for it separately.